fix(cdk): allow managed environment stack update

infra/cdk/README.md

@@ -223,6 +223,11 @@ event, so `s3:DeleteObject` is scoped to the same AWS-confirmed
 `arn:aws:s3:::elasticbeanstalk-*/*` object namespace as `GetObjectAcl`. The
 policy does not grant wildcard S3 actions or access to non-Beanstalk buckets.
 
+The following rerun passed both denials and reached the delegated
+CloudFormation update, which required `cloudformation:UpdateStack`. That
+mutation is limited to the single existing Elastic Beanstalk-managed stack ARN
+for `shoc-backend-dev`; it cannot create stacks or update any other stack.
+
 The pinned deployment action can return success after Elastic Beanstalk emits a
 fatal deployment event. The following workflow step therefore verifies that
 the exact immutable version label is active and healthy before smoke testing.

infra/cdk/deploy-dev-stack.ts

@@ -94,6 +94,7 @@ export class DeployDevStack extends cdk.Stack {
           'cloudformation:DescribeStackResources',
           'cloudformation:DescribeStacks',
           'cloudformation:ListStackResources',
+          'cloudformation:UpdateStack',
         ],
         resources: [
           `arn:aws:cloudformation:${REGION}:${ACCOUNT_ID}:stack/${ENVIRONMENT_STACK_NAME}/*`,